#1156-D: reject invalid runtime/tier and fail launcher closed #1182

Open
opened 2026-08-13 00:29:58 +00:00 by mos-dt-0 · 0 comments
Collaborator

Child of #1156 and the explicit W-F1 prerequisite gate.

Findings

  • FL-07: invalid non-empty CHAT_HARNESS_RUNTIME silently selects legacy embedded runtime.
  • FL-08: invalid non-empty MOSAIC_STORAGE_TIER silently falls through to local PGlite.
  • FL-09: launcher spawnSync error/signal/null status is converted to exit 0 (status ?? 0).
  • FL-10: mandatory launch-ledger/provenance write failure only warns and launches anyway.

Binding outcome

  • Closed enums: invalid explicit runtime/tier values fail typed before runtime/storage selection; only true absence may retain a documented transitional/local default.
  • Spawn errors, signals and null status are typed sanitized nonzero failures.
  • If launch provenance is mandatory, record failure prevents spawn; no recordless successful launch or fabricated launch ID.
  • Red-first tests prove each condition and zero embedded/storage/spawn effects on refusal.
  • Add narrow anti-drift checks for invalid-enum fallthrough, status ?? 0, and warn-and-run mandatory provenance.
  • Preserve #1109 lease-broker mechanism and do not implement W-F1 composition in this child.
  • Full affected package/repository tests/typecheck/lint/build, independent exact-head verifier and focused security review.

W-F1 authoring remains held until this child merges and its exact merge SHA is recorded in the W-F1 charter. All four #1156 children bind before native stage. Split again rather than make this a launcher/config mega-PR.

Child of #1156 and the explicit **W-F1 prerequisite gate**. ## Findings - FL-07: invalid non-empty `CHAT_HARNESS_RUNTIME` silently selects legacy embedded runtime. - FL-08: invalid non-empty `MOSAIC_STORAGE_TIER` silently falls through to local PGlite. - FL-09: launcher `spawnSync` error/signal/null status is converted to exit 0 (`status ?? 0`). - FL-10: mandatory launch-ledger/provenance write failure only warns and launches anyway. ## Binding outcome - Closed enums: invalid explicit runtime/tier values fail typed before runtime/storage selection; only true absence may retain a documented transitional/local default. - Spawn errors, signals and null status are typed sanitized nonzero failures. - If launch provenance is mandatory, record failure prevents spawn; no recordless successful launch or fabricated launch ID. - Red-first tests prove each condition and zero embedded/storage/spawn effects on refusal. - Add narrow anti-drift checks for invalid-enum fallthrough, `status ?? 0`, and warn-and-run mandatory provenance. - Preserve #1109 lease-broker mechanism and do not implement W-F1 composition in this child. - Full affected package/repository tests/typecheck/lint/build, independent exact-head verifier and focused security review. W-F1 authoring remains held until this child merges and its exact merge SHA is recorded in the W-F1 charter. All four #1156 children bind before native stage. Split again rather than make this a launcher/config mega-PR.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1182